c6367e4464954cf7578ac19b1c76d48c25ea235985da0f1c7139039dd5a5f7ed | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c6367e4464954cf7578ac19b1c76d48c25ea235985da0f1c7139039dd5a5f7ed
Size

362KB
MD5

2271c77c0603d933ace0590dc65d0520
SHA1

76cd4efb2ebc9a594da6d42840d69575cbae3840
SHA256

c6367e4464954cf7578ac19b1c76d48c25ea235985da0f1c7139039dd5a5f7ed
SHA512

265eae1ec0448256272e3c5256eb332c211ea4b86b862129fa9886e9c941724223f6ff3e136127bbf3291f61b424ac3d597d0a4cee904f4a61baed29711e8913
SSDEEP

6144:CrvgxUZs7G96WapZm+Sr+zX5CPln7P+GPnsnZiEpY0Ieigv53yb8Ne5TWJi6g:rkD9RapZzGp7P+GPsnZlI1+hsrBei6g

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

c6367e4464954cf7578ac19b1c76d48c25ea235985da0f1c7139039dd5a5f7ed
.dll regsvr32 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

UPX0
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 354KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE